chmod 700 (rwx------)
Answer
chmod 700 sets rwx------: the owner can read, write and execute (or, for a directory, list, enter and change it), and nobody else can do anything with it. It is the standard mode for private directories such as ~/.ssh.
chmod 700 = rwx------: owner full access, everyone else nothing.
| Read 4 | Write 2 | Execute 1 | Digit | |
|---|---|---|---|---|
| Owner (user) | 7 | |||
| Group | 0 | |||
| Others | 0 | |||
| Special | 0 |
7Owner (user): 7 = 4 read + 2 write + 1 execute0Group: 0 = no permissions0Others: 0 = no permissions
On a file
- Owner (user) read it, change it and run it as a program
- Group no access
- Others no access
On a directory
- Owner (user) list the names inside, enter it and open files by name, create and rename and delete entries
- Group no access
- Others no access
chmod 700 filechmod u=rwx,go= filels -l → -rwx------
What to know
On a directory, 700 hides both the names inside and the files themselves from everyone but the owner, whatever the files' own modes are, because no one else can enter the directory.
On a file, 700 means a program or script only you can run. That is the main difference from 600: the execute bit.
Where it fits
~/.ssh(the directory; the private keys inside are 600)~/.gnupg, which GnuPG warns about if it is more open- Personal scripts in ~/bin that nobody else should run or read
- Private working directories, backups and per-user state directories
Gotchas
- OpenSSH does not strictly require 700 on
~/.ssh: StrictModes only rejects it if it is writable by group or others, so 755 is accepted. 700 is still the recommended setting. - 700 on a web root or a directory a service must read will cause "Permission denied" or 403 errors, because the server user cannot enter it.
chmod -R 700makes every file executable. For a private tree,chmod -R u=rwX,go=gives directories 700 and data files 600.
Related explainers
- chmod 600 (rw-------)chmod 600 makes a file readable and writable by its owner only. The right mode for SSH private keys, .env...
- chmod 755 (rwxr-xr-x)chmod 755 gives the owner read, write and execute, and everyone else read and execute. When to use it for...
- chmod 750 (rwxr-x---)chmod 750 gives the owner full access, the group read and execute, and others nothing. Used for app...
- umask 077umask 077 creates files as 600 and directories as 700, so nothing you create is visible to other users....